From 318d12addd997458a1c2bfa2b20bf58cfb2c7711 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com>
Date: Wed, 6 Mar 2024 02:18:43 +0100
Subject: [PATCH] Feat: Machine Identity support

---
 k8-operator/packages/api/api.go | 80 ++++++++++++++++++++++++++++++---
 1 file changed, 73 insertions(+), 7 deletions(-)

diff --git a/k8-operator/packages/api/api.go b/k8-operator/packages/api/api.go
index 15de04321..e69930ce1 100644
--- a/k8-operator/packages/api/api.go
+++ b/k8-operator/packages/api/api.go
@@ -58,7 +58,6 @@ func CallGetSecretsV3(httpClient *resty.Client, request GetEncryptedSecretsV3Req
 		R().
 		SetResult(&secretsResponse).
 		SetHeader("User-Agent", USER_AGENT_NAME).
-		SetHeader("If-None-Match", request.ETag).
 		SetQueryParam("environment", request.Environment).
 		SetQueryParam("include_imports", "true"). // TODO needs to be set as a option
 		SetQueryParam("workspaceId", request.WorkspaceId)
@@ -77,13 +76,10 @@ func CallGetSecretsV3(httpClient *resty.Client, request GetEncryptedSecretsV3Req
 		return GetEncryptedSecretsV3Response{}, fmt.Errorf("CallGetSecretsV3: Unsuccessful response. Please make sure your secret path, workspace and environment name are all correct [response=%s]", response)
 	}
 
-	if response.Header().Get("etag") == request.ETag {
-		secretsResponse.Modified = false
-	} else {
-		secretsResponse.Modified = true
-	}
+	responseETag := response.Header().Get("etag")
 
-	secretsResponse.ETag = response.Header().Get("etag")
+	secretsResponse.Modified = request.ETag != responseETag
+	secretsResponse.ETag = responseETag
 
 	return secretsResponse, nil
 }
@@ -107,6 +103,76 @@ func CallGetServiceTokenAccountDetailsV2(httpClient *resty.Client) (ServiceAccou
 	return serviceAccountDetailsResponse, nil
 }
 
+func CallUniversalMachineIdentityLogin(request MachineIdentityUniversalAuthLoginRequest) (MachineIdentityDetailsResponse, error) {
+	var machineIdentityDetailsResponse MachineIdentityDetailsResponse
+
+	response, err := resty.New().
+		R().
+		SetResult(&machineIdentityDetailsResponse).
+		SetBody(request).
+		SetHeader("User-Agent", USER_AGENT_NAME).
+		Post(fmt.Sprintf("%v/v1/auth/universal-auth/login", API_HOST_URL))
+
+	if err != nil {
+		return MachineIdentityDetailsResponse{}, fmt.Errorf("CallUniversalMachineIdentityLogin: Unable to complete api request [err=%s]", err)
+	}
+
+	if response.IsError() {
+		return MachineIdentityDetailsResponse{}, fmt.Errorf("CallUniversalMachineIdentityLogin: Unsuccessful response: [response=%s]", response)
+	}
+
+	return machineIdentityDetailsResponse, nil
+}
+
+func CallUniversalMachineIdentityRefreshAccessToken(request MachineIdentityUniversalAuthRefreshRequest) (MachineIdentityDetailsResponse, error) {
+	var universalAuthRefreshResponse MachineIdentityDetailsResponse
+
+	response, err := resty.New().
+		R().
+		SetResult(&universalAuthRefreshResponse).
+		SetHeader("User-Agent", USER_AGENT_NAME).
+		SetBody(request).
+		Post(fmt.Sprintf("%v/v1/auth/token/renew", API_HOST_URL))
+
+	if err != nil {
+		return MachineIdentityDetailsResponse{}, fmt.Errorf("CallUniversalAuthRefreshAccessToken: Unable to complete api request [err=%s]", err)
+	}
+
+	if response.IsError() {
+		return MachineIdentityDetailsResponse{}, fmt.Errorf("CallUniversalAuthRefreshAccessToken: Unsuccessful response [%v %v] [status-code=%v] [response=%v]", response.Request.Method, response.Request.URL, response.StatusCode(), response.String())
+	}
+
+	return universalAuthRefreshResponse, nil
+}
+
+func CallGetDecryptedSecretsV3(httpClient *resty.Client, request GetDecryptedSecretsV3Request) (GetDecryptedSecretsV3Response, error) {
+	var decryptedSecretsResponse GetDecryptedSecretsV3Response
+
+	response, err := httpClient.
+		R().
+		SetResult(&decryptedSecretsResponse).
+		SetHeader("User-Agent", USER_AGENT_NAME).
+		SetQueryParam("secretPath", request.SecretPath).
+		SetQueryParam("workspaceId", request.ProjectID).
+		SetQueryParam("environment", request.Environment).
+		Get(fmt.Sprintf("%v/v3/secrets/raw", API_HOST_URL))
+
+	if err != nil {
+		return GetDecryptedSecretsV3Response{}, fmt.Errorf("CallGetDecryptedSecretsV3: Unable to complete api request [err=%s]", err)
+	}
+
+	if response.IsError() {
+		return GetDecryptedSecretsV3Response{}, fmt.Errorf("CallGetDecryptedSecretsV3: Unsuccessful response: [response=%s]", response)
+	}
+
+	responseETag := response.Header().Get("etag")
+
+	decryptedSecretsResponse.Modified = request.ETag != responseETag
+	decryptedSecretsResponse.ETag = responseETag
+
+	return decryptedSecretsResponse, nil
+}
+
 func CallGetServiceAccountWorkspacePermissionsV2(httpClient *resty.Client) (ServiceAccountWorkspacePermissions, error) {
 	var serviceAccountWorkspacePermissionsResponse ServiceAccountWorkspacePermissions
 	response, err := httpClient.